Preserve final dynamic secret tags in inspection

internal/engine/metadata.go

@@ -150,6 +150,9 @@ func freezeMetadataHistory(m *Metadata, final *document.Node) {
 		panic("configkit: metadata history prefix is not ready")
 	}
 	builder.model.final = final
+	// A resolver may change dynamic field tags without changing canonical values
+	// or producing a resolution snapshot. Always observe the final classification.
+	builder.observeDocument(final, historyPhaseResolution)
 	m.historyModel = builder.freeze()
 	m.historyBuilder = nil
 }